YAML Metadata Warning:empty or missing yaml metadata in repo card
Check out the documentation for more information.
Security PoC — torch.package model-scanner evasion (huntr MFV)
This is a security-research proof-of-concept for a huntr Model File Vulnerabilities (MFV) submission. It is not malware — the payload only writes a harmless marker to /tmp (echo/id). Do not modify to run real commands.
What it demonstrates
Loading malicious_pkgmod.pt with the default torch.package.PackageImporter(...).load_pickle() API executes code, while modelscan and picklescan scan the file and report no issues — a model-scanner false-negative. The malicious logic lives in packaged module source (benignmod.py), executed via find_class → import_module → compile(..., "exec"); the embedded pickle carries no dangerous opcodes (GLOBAL benignmod.Widget + STOP).
Environment
pip install torch==2.13.0 modelscan==0.8.8 picklescan==1.0.4 # Python 3.10+
Reproduce
# scanners report CLEAN even though they scan the embedded pickle
modelscan -p malicious_pkgmod.pt # -> "No issues found! 🎉"
picklescan -p malicious_pkgmod.pt # -> "Infected files: 0, Dangerous globals: 0"
# default-API load executes code
rm -f /tmp/huntr_pkgmod_pwned
python load_pkgmod.py # -> marker: True pwned-pkgmod-<user>
cat /tmp/huntr_pkgmod_pwned
Control: the naive __reduce__/posix.system variant of the same archive is flagged CRITICAL by both scanners — proving the evasion is specific to the module-source technique, not an unsupported-format skip.
Files: malicious_pkgmod.pt (PoC), build_malicious_pkgmod.py (craft), load_pkgmod.py (loader), ref_interned.pt (benign reference).